ExamGecko
Question list
Search
Search

Question 305 - 350-701 discussion

Report
Export

Which type of DNS abuse exchanges data between two computers even when there is no direct connection?

A.

Malware installation

Answers
A.

Malware installation

B.

Command-and-control communication

Answers
B.

Command-and-control communication

C.

Network footprinting

Answers
C.

Network footprinting

D.

Data exfiltration

Answers
D.

Data exfiltration

Suggested answer: D

Explanation:

Malware installation: This may be done by hijacking DNS queries and responding with malicious IP addresses.

Command & Control communication: As part of lateral movement, after an initial compromise, DNS communications is abused to communicate with a C2 server. This typically involves making periodic DNS queries from a computer in the target network for a domain controlled by the adversary. The responses contain encoded messages that may be used to perform unauthorized actions in the target network.

Network footprinting: Adversaries use DNS queries to build a map of the network. Attackers live off the terrain so developing a map is important to them.

Data theft (exfiltration): Abuse of DNS to transfer data; this may be performed by tunneling other protocols like FTP, SSH through DNS queries and responses. Attackers make multiple DNS queries from a compromised computer to a domain owned by the adversary. DNS tunneling can also be used for executing commands and transferring malware into the target network.

Reference: https://www.netsurion.com/articles/5-types-of-dns-attacks-and-how-to-detect-them

asked 10/10/2024
Shariifa DEME
33 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first